SDSI Practice Test 17 — 15 Questions

Question 1

Which THREE design principles are key for a multi-cloud security strategy?

Accepted Answer

Consistent security policies across environments.. Multi-cloud security relies on centralized management, consistent policy, and visibility.

Answer

Using different security tools for each cloud.

Answer

Allowing all cross-cloud traffic.

Question 2

A design requirement for a SOC environment is to have real-time visibility into who is on the network. Which Cisco tool is best for this?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco ISE provides real-time tracking of all network authentication and access events.

Answer

Cisco Umbrella.

Answer

Cisco Firepower Management Center.

Answer

Cisco SecureX.

Question 3

A financial institution is performing a risk assessment on its cloud-to-on-premises connection. The assessment methodology indicates a high risk of man-in-the-middle attacks. Which design modification is required to align with Cisco security design best practices?

Accepted Answer

Implement mTLS and certificate-based authentication. Enforcing mutual TLS (mTLS) and certificate-based authentication is the standard design modification to prevent MITM attacks in secure tunnel architectures.

Answer

Reduce key size to 1024-bit for compatibility

Answer

Disable IKEv2 and force IKEv1

Answer

Enable split-tunneling

Question 4

A network designer needs to implement a VPN that supports both remote access and site-to-site connectivity. Which protocol is recommended for modern Cisco hardware?

Accepted Answer

IKEv2.. IKEv2 is the standard for modern VPNs, supporting both Remote Access and Site-to-Site with high security and flexibility.

Answer

SSL VPN.

Answer

IKEv1.

Answer

PPTP.

Question 5

Which Cisco platform provides a centralized view of security threats across the entire enterprise?

Accepted Answer

Cisco SecureX.. Cisco SecureX (now evolving into XDR) is the platform for unifying security visibility and orchestration.

Answer

Cisco Catalyst Center.

Answer

Cisco Webex Control Hub.

Answer

Cisco DNA Center.

Question 6

What is the benefit of integrating Cisco Secure Email with Cisco Threat Intelligence (Talos)?

Accepted Answer

It provides real-time threat intelligence for filtering.. Talos provides real-time updates on malicious domains and file signatures, blocking threats before they reach the inbox.

Answer

It increases email storage capacity.

Answer

It creates automated email backups.

Answer

It allows for remote administration of the email server.

Question 7

Which design principle is essential when configuring Cisco Secure Firewall for SaaS application visibility?

Accepted Answer

Enable Application Filtering policies using the cloud-delivered feed.. Cloud-native application visibility is enabled by the Cisco Secure Firewall's integration with the Cisco Talos Intelligence service for application classification.

Answer

Disable SSL decryption for all SaaS traffic to improve performance.

Answer

Install local agents on every endpoint.

Answer

Configure static IP-based rules for every SaaS provider.

Question 8

During a post-incident review, an architect discovers that the SOC could not correlate logs across the Cisco Secure Email and Cisco Secure Endpoint platforms. Which integration should the design specify to improve future incident response?

Accepted Answer

Cisco Security Cloud Control (SecureX). Cisco SecureX (now Cisco Security Cloud Control) provides the necessary orchestration and correlation across Cisco security products.

Answer

Cisco Webex Control Hub

Answer

Cisco DNA Center

Answer

Cisco ThousandEyes

Question 9

Which TWO factors are vital for an effective firewall policy design?

Accepted Answer

Logical organization and rule documentation.. Policy design must prioritize explicit rules and maintainable structure.

Answer

Disabling all logging.

Answer

Using only IP addresses.

Answer

Permit all traffic by default.

Question 10

In a design for a Zero Trust architecture, what is the primary function of the Policy Decision Point (PDP)?

Accepted Answer

To evaluate access requests based on policy. The PDP is responsible for evaluating access requests against defined security policies and making the final 'permit' or 'deny' decision.

Answer

To audit session traffic

Answer

To provide identity management

Answer

To enforce the policy on the endpoint

Question 11

A design team is integrating Cisco Secure Firewall with an existing SIEM. Which telemetry export format is best for comprehensive security analysis?

Accepted Answer

eStreamer. Cisco Secure Firewall supports eStreamer and Syslog, but eStreamer is the specialized protocol for granular security event data.

Answer

NetFlow

Answer

SNMP

Answer

ICMP

Question 12

In a multi-cloud design, which protocol is preferred for secure inter-site communication to support micro-segmentation?

Accepted Answer

VXLAN with SGTs.. VXLAN with SGT (Group-Based Policy) allows for consistent policy enforcement across multi-cloud and data center environments.

Answer

Standard GRE.

Answer

VLAN tagging.

Answer

802.1Q.

Question 13

Which THREE technologies enable network segmentation in a modern Cisco campus design?

Accepted Answer

VRF-Lite.. Segmentation is achieved through identity-based tags, virtualization, and VLAN isolation.

Answer

Standard routing protocols without filters.

Answer

Port forwarding.

Question 14

Which TWO features assist in protecting the network control plane against DoS attacks?

Accepted Answer

Control Plane Policing (CoPP).. Control plane security requires limiting CPU-bound traffic and filtering malicious sources.

Answer

Configuring static routing only.

Answer

Increasing interface speed.

Answer

Disabling all physical interfaces.

Question 15

Which protocol is recommended for secure network time synchronization across security devices?

Accepted Answer

NTP with Authentication. NTP with authentication is the industry standard for secure time synchronization.

Answer

SNMP

Answer

HTTP

Answer

DHCP